Watching for Other Users

zsh provides a useful means for watching and reporting logins or logouts
for a certain user, from a certain host, and/or on a certain line.
(tty, pty, etc.)

First, we look at what an event is, and examples of event entries.
Then, we learn how to feed those events to zsh, and how to get useful
reports from zsh. On the next page, we learn how to customize the
appearance of these reports.

Events

For the purposes of this section, an event will refer to
any login or logout on the host where zsh is running.

An event consists of the following:

The user who logged in/out

The host where the user was connected from

The line (tty) that the user was connected on

To look for events associated with a particular user,
simply use their username in the event specification.
To look for events from a specific host, use '@' followed
immediately by the remote hostname.
To look for events on a specific line, use '%' followed
immediately by the line name. (IE, pts/186)

Any or all of these components can be present when specifying events.
Zsh then reports any event that matches ALL components
of the entry.

Examples of Event Entries

An entry that matches all events associated with user schrof:

schrof

An entry that matches all events from hostname nebcorp.comand on line pts/19:

@nebcorp.com%pts/19

An entry that matches all events of user root on console:

root%console

Telling zsh to look for events

You need to put the list of events that zsh should watch for in the
watch or WATCH shell variable. This can be
done
from the command line, but you'll probably want to
Normally,
setting one changes the other. If the shell is
invoked in sh or ksh emulation mode, however, you'll
have to use the (uppercase) WATCH
parameter.

Normally, you'll assign an array value to the watch
parameter. There are, however, two special cases which we discuss
first.

1. To monitor every event on the system, you can
assign the single value of all to the watch
parameter:

watch=all

2. To monitor all events except your own (tied to
$USERNAME), assign the single value notme:

watch=notme

Otherwise, you'll need to assign a list of events:

watch=(event1 event2 ... eventN)

Zsh then reports all events that fully match any of the entries
you placed in the watch parameter.

(See the top of this page for info on specifying event entries)

Obtaining the Report

Setting LOGCHECK to some interger n will
cause zsh to report monitored events every n
seconds. (60 seconds is the default.) You can have zsh report all
users currently logged in who are affected by the watch parameter
by running the log command at any time.

The next page contains detailed information on configuring how the
reports look.